& Red Hat 


RED HAT CODE OF BUSINESS CONDUCT AND ETHICS 


This Code of Business Conduct and Ethics (the “Code”) sets forth legal and ethical 
standards of conduct for employees of Red Hat, Inc. and its subsidiaries (the “Company” 
or “Red Hat”). Red Hat, Inc.'s “subsidiaries” are entities it directly or indirectly, through 
one or more intermediaries, controls. This Code is intended to deter wrongdoing and to 
promote the conduct of all Company business in accordance with high standards of 
integrity and in compliance with all applicable Company policies, laws, and regulations. 
This Code applies to all Red Hat employees. 


If you have any questions regarding this Code or its application to you in any situation, 
you should contact your manager or the Legal Department. 


COMPLIANCE WITH THE CODE AND ALL LAWS, RULES AND 
REGULATIONS 


The Company requires that all employees comply with this Code, Company policies, and all 
laws, rules, and regulations applicable to the Company wherever it does business, including 
with respect to the conduct of business with governments and the protection of classified 
information. You are expected to be familiar with the laws, rules, regulations, and Company 
policies applicable to your work and workplace as well as additional laws, rules, and 
regulations that may apply. 


You are expected to use good judgment and common sense in seeking to comply with all 
applicable laws, rules, regulations, and Company policies, and to ask for advice from your 
manager or the Legal Department when you are uncertain about them. 


If you become aware of or suspect a violation of this Code or other unethical or unlawful 
conduct by the Company, whether by its employees or any third party in connection with 
Red Hat's business, Red Hat expects you to promptly report the matter to your manager or 
the Legal Department (see “Reporting and Compliance Procedures” below). The Company 
will promptly review your report of actual or potential violations of the Code or other 
unlawful or unethical conduct. While it is the Company's desire to address matters 
internally, nothing in the Code prohibits you from communicating directly with any 
government agency or entity, without prior consent of, or notification to, the Company to 
the extent permitted by law and applicable rules of professional responsibility. Employees 
shall not terminate, demote, suspend, threaten, harass, or in any other manner discriminate 
against any other employees because they in good faith reported any such violation. 
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HONEST AND ETHICAL CONDUCT 
Respect in the Workplace 


Red Hat strives to create an environment of belonging, respect, and mutual support where 
everyone feels valued, and will not tolerate unlawful discrimination, harassment, bullying, 
favoritism, or retaliation of any kind. Red Hat prohibits any discrimination or harassment on 
the basis of age, physical or mental disability, race, color, ethnicity or national origin, sex, 
gender, pregnancy, sexual orientation, gender identity or expression, religious belief, marital 
status, genetic information, military or veteran status, or any other characteristic protected 
by law. The Company will not tolerate unwelcome sexual advances or comments, racial or 
religious slurs or jokes, or any other conduct, such as bullying, that creates or encourages an 
offensive or intimidating work environment. Please also consult Red Hat's Global Policy 
Prohibiting Discrimination, Harassment, Bullying, Favoritism and Retaliation, which is 
available in the Global Legal Policies page of The Source. If you believe you are the victim 
of prohibited workplace conduct, contact the Legal Department (see “Reporting and 
Compliance Procedures” below) or the People Team (peoplerelations@redhat.com). 


Conflicts of Interest 


Employees are expected to act in the best interests of the Company with integrity and high 
ethical standards, and avoid conduct that creates, or appears to create, a conflict of 
interest. 


A “conflict of interest” exists when a personal interest - which can be a direct benefit to you 
or a benefit to a family member or close friend - interferes with the best interests of the 
Company and its stakeholders. A conflict of interest may arise whenever you, as an 
employee of the Company, take action or have an interest that impairs your ability to 
perform your duties and responsibilities honestly, objectively, and effectively. 


For example, a conflict of interest may arise from your business or personal relationship with 
a customer, supplier, competitor, business partner, or other associate, if that relationship 
impairs objective business judgment or your ability to perform your duties for the Company 
effectively. A conflict of interest may also arise from personal investments, outside 
consulting or employment, service on the board of another entity, starting your own 
business, giving or receiving business amenities or gifts from a current or future supplier or 
business partner, romantic relationships with co-workers or business partners, and other 
activities or relationships that Red Hat may reasonably determine to constitute a conflict. 


In addition to avoiding actual conflicts of interest, employees must avoid conduct that 
would reasonably present the appearance of a conflict of interest to others. Remember that 
sometimes a situation that previously did not present a conflict of interest may develop into 
one. 
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If you are aware of a conflict of interest, have a concern that a conflict of interest may exist, 
or have a concern that a situation creates even the appearance of a conflict of interest, it is 
your responsibility to promptly notify the Legal Department (see “Reporting and 
Compliance Procedures” below) and provide the information you have about the situation 
and cooperate in its review. 


The Company will consider the facts and circumstances of the situation to determine 
whether an actual or apparent conflict exists, after taking into consideration any corrective 
or mitigating action that has been or will be taken. 


Participation in an open source community project, whether maintained by the Company or 
by another commercial or non-commercial entity or organization, does not constitute a 
conflict of interest even where you may make a determination in the interest of the project 
that is adverse to the Company's interests. 


Honesty and Fair Dealing 


Be Honest. Employees should endeavor to deal honestly, ethically, and fairly with the 
Company's suppliers, customers, competitors, and employees. Statements regarding the 
Company's and competitors’ products and services must not be untrue, misleading, 
deceptive, or fraudulent. You must not take unfair advantage of anyone through 
manipulation, concealment, abuse of privileged information, misrepresentation of material 
facts, or any other unfair-dealing practice. Both making false statements and omitting 
important facts are wrong. 


Do not engage in or facilitate any improper or illegal practices, such as wiretapping, 
surveillance, hacking, bribery, theft, trespassing, misuse of social platforms or pretexting, to 
gather intelligence or to obtain trade secrets or confidential or sensitive information. Do not 
hire or pay a competitor's employees to obtain such information. Do not accept or use 
information if you have reason to believe it may have been obtained improperly or illegally. If 
you receive a competitor's confidential information (such as a pricing proposal), by mistake 
or intentionally, from a client or other party, do not review it, distribute it, or otherwise use it. 
Instead, immediately call the Legal Department for guidance on how to proceed. 


The Company's internal processes and controls are implemented to help ensure we do 
business the right way. Make sure you understand which Company processes and controls 
apply to what you do. If you're unsure, ask! If you think a process or control is unclear or 
could be improved, talk about it with your manager, the process owner, or Red Hat Business 
Controls. 


Don't bypass a Company process or control without an authorized exception, and if you see 
others bypassing, say something. If a customer or other third party asks you to bypass the 
Company's (or their own) controls, or assist them in doing so, notify your manager or the 
Legal Department. 
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Reporting and Recording Information. Employees regularly provide to the Company 
and others information and data, such as requests for reimbursement of business expenses, 
hours worked on customer projects, or certifications. 


The Company relies on employees to record and report accurate, complete, and honest 
information. Under various laws, the Company is required to maintain accurate books and 
records. Misrepresentation can lead to civil and criminal penalties for both you and the 
Company, and the loss of business privileges, such as the right to bid on business, export or 
import products or even remain in business. 


Record and report only accurate, complete, and honest information. Never report 
information in a way that is intended to mislead or misinform those who receive it. If you are 
unsure about the accuracy or completeness of any information, don’t guess. Ask for help. If 
you believe any information you've recorded or reported to the Company or others is 
incorrect or has been misunderstood, promptly notify your manager and the Legal 
Department to determine the appropriate next steps. 


Some examples of dishonest or fraudulent reporting include: 
e Submitting false or inaccurate expense reimbursement requests; 


e Inaccurately recording the number of hours worked or failing to report time (or 
overtime in accordance with Company guidelines) worked, whether or not charged 
to a customer; 


e Submitting inaccurate information to the Company's tools or processes; 


e Providing inaccurate or incomplete information to the Company or other parties, 
including during investigations, audits, or other reviews; and 


e Making false or misleading statements in (or omitting material information from) 
external reports or other documents submitted to government agencies. 


Understanding Financial Controls and Reporting. As a subsidiary of a public company, 
the Company must follow strict accounting principles and standards, report financial 
information accurately and completely, and have appropriate internal controls and 
processes to ensure that our accounting and financial reporting comply with all applicable 
laws. Violating accounting and financial reporting laws can result in significant fines, 
penalties, and imprisonment. 


The rules for accounting and financial reporting require the proper recording of, and 
accounting for, revenues, costs, expenses, assets, liabilities, and cash flows. The Company 
must recognize revenue accurately. Be sure to discuss with Accounting all factors that could 
impact revenue recognition, such as deviations from standard payment terms, 
non-standard warranties, contingencies in deals, or deviations from customary ordering 
procedures. If you have responsibility or involvement in these areas, you must understand 
and follow these rules. These rules also prohibit you from assisting others to record or to 
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report any information inaccurately or to make false or misleading financial reports. Never 
provide advice to others, including customers, suppliers, or business partners, about how 
they should record or report their own revenues, costs, expenses, assets, and liabilities. 


If you are aware of or suspect any improper or unethical accounting or financial reporting, 
you should immediately inform the Legal Department at legal@redhat.com or by calling Red 
Hat's Compliance and Ethics Hotline at 800-224-9902 or 678-999-4553. You may do 
this anonymously, except where anonymous reporting is prohibited by law, if you wish. 


Making Commitments and Obtaining Approvals 


The Company has established approval processes and delegation levels to help us protect 
our assets, maintain appropriate controls, and run our business effectively. Understand and 
follow the approval processes and delegation levels that apply to your role. Do not make 
business commitments, including modifications to pricing, contract, or service terms, 
without appropriate approvals or contrary to delegation limits. All commitments must be 
reported to Accounting to ensure the accuracy of the Company's books and records. Unless 
you are specifically authorized by Red Hat's signature authority policies, you do not have 
authorization to enter into any agreement on behalf of the Company. Do not make verbal 
arrangements or commitments, or enter into unapproved written commitments or side 
deals. 


Human Rights 


Red Hat, as a global company, considers respect for human rights to be an integral part of 
its corporate social responsibility commitments. The Company prohibits child labor, human 
trafficking, forced labor (and all other forms of modern slavery) in any guise in its operations 
and supply chain. All employees are expected to help identify and prevent modern slavery in 
Red Hat's operations and supply chain and immediately report any concerns to the Legal 
Department. 


SAFEGUARDING CONFIDENTIAL INFORMATION AND COMPANY ASSETS 
Confidentiality 


Employees must maintain the confidentiality of confidential information entrusted to them 
by the Company, IBM, or other companies, including the Company’s suppliers and 
customers, except when disclosure is authorized by a manager or legally mandated. 
Unauthorized disclosure of any confidential information is prohibited. Additionally, 
employees should take appropriate precautions to ensure that confidential or sensitive 
business information, whether it is proprietary to the Company or another company, is not 
communicated within the Company except to employees who have a need to know such 
information to perform their responsibilities for the Company. 
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Be careful to avoid inadvertent disclosure of proprietary and confidential information, 
whether owned by the Company or others. Do not discuss this information with, or within 
hearing range of, any unauthorized person, including family members or friends. They might 
- innocently or otherwise - pass the information on to someone else. 


Third parties may ask you for information concerning the Company. Employees (other than 
the Company's authorized spokespersons) must not discuss internal Company matters 
with, or disseminate internal Company information to, anyone outside the Company, except 
as required in the performance of their Company duties and after an appropriate 
confidentiality agreement is in place. This prohibition applies particularly to inquiries 
concerning the Company from the media, market professionals (such as securities analysts, 
institutional investors, investment advisers, brokers and dealers), and security holders. All 
responses to inquiries on behalf of the Company must be made only by the Company’s 
authorized spokespersons. If you receive any inquiries of this nature, you must decline to 
comment and refer the inquirer to your manager or one of the Company’s authorized 
spokespersons. The Company's policies with respect to public disclosure of internal matters 
are described more fully in the Noncompetition, Confidentiality, and Assignment of 
Inventions Agreement that you signed at the time you joined the Company. 


You also must abide by any lawful obligations that you have to your former employer. These 
obligations may include restrictions on the use and disclosure of confidential information, 
restrictions on the solicitation of former colleagues to work at the Company, and 
non-competition obligations. 


Finally, if you are involved in conducting business in government marketplace(s) at any level, 
you may be subject to other obligations regarding the use, disclosure, safeguarding, or 
receipt of particular types of information, including restrictions regarding 
competition-sensitive information such as government “source selection” or contractor bid 
and proposal information. 


Insider Trading 


During your employment with the Company, you may become aware of information about 
the Company, its parent company IBM, or other companies that has not been made public. 
Using or disclosing this inside information for your financial or other personal benefit is 
unethical and against the law. Inside information is material information that is not available 
to the general public that could influence a reasonable investor to buy, sell, or hold a 
company’s securities. Information can be material even if it would have only a small impact 
on the price of the securities. Violation of these laws may result in civil and criminal 
penalties, including fines and jail sentences. The Company will not tolerate the improper use 
of inside information. These prohibitions apply anywhere in the world where we do business. 
The rules are simple: do not improperly use or disclose inside information; and do not evade 
these guidelines by acting through anyone else or by giving inside information to others for 
their use, even if you will not financially benefit from it. If you have any questions about what 
you can or cannot do, consult the Legal Department. 
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Do not disclose to anyone outside of the Company, including your family members, or to 
your Company colleagues who do not have a business need to know: 


e Inside information about the Company's or IBM's financial performance, including 
unannounced earnings and dividend actions, acquisitions or divestitures, and other 
significant activities affecting the Company or IBM; or 


e Inside information about the Company or any other company. 


Do not buy or sell IBM securities or securities of a customer, business partner, or other party 
based on inside information you have about IBM, the Company, or that company. For 
example, if you know that the Company or IBM is considering a significant relationship with 
a business partner, do not buy or sell the securities of that company until after the 
information becomes public. 


Managing Personal Information 


The Company takes your privacy seriously. Not all countries have data protection laws, but 
the Company has privacy and data protection policies intended to protect personal 
information wherever we use, process, or store it. Always comply with applicable privacy 
laws and Company privacy policies applicable to you. You acknowledge that the Company 
may collect, use, disclose, and otherwise process your personal information as provided in 
the Employee Personal Information Privacy Statement. 


Guarding Against Cyberthreats 


Third parties, like our customers, trust the Company with their data and other assets, and 
we rely on you to protect them - as well as the Company's own data and assets. 


Follow the Company's information security policies, controls, and processes. Violating the 
Company's information security policies puts the Company's assets, and assets belonging 
to others, like customer data, at risk. Even well-intentioned actions, such as creating 
work-arounds and shortcuts to improve service delivery or downloading unapproved 
third-party software, can violate the Company's and customers’ security policies, and result 
in IT or data breaches. 


If you are aware of or suspect an IT or data security issue or incident, or any loss of assets, 
including data, belonging to the Company or others, report it immediately by contacting 
infosec@redhat.com. 


Protection and Proper Use of Corporate Assets 


Employees should seek to protect the Company's assets. Theft, carelessness, and waste 
have a direct impact on the Company's financial performance. Other than limited personal 
use of Red Hat's systems as specifically allowed by Red Hat's Policy on Acceptable Use of 
Red Hat Information Technology Systems, employees must use the Company's assets and 
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services solely for legitimate business purposes of the Company and not for any personal 
benefit or the personal benefit of anyone else. 


Employees must advance the Company's legitimate interests when the opportunity to do 
so arises. You must not take advantage of opportunities for yourself or another person that 
are discovered through your position with the Company or the use of property or 
information of, or entrusted to, the Company. 


Retaining Records 


Our records are valuable assets. Always follow applicable Company records management 
policies and document retention orders issued by the Legal Department for retaining and 
disposing of Company records. Keep in mind that these policies apply to information in any 
media, including hard copy and electronic records, email, wikis, blogs, apps, and records in 
collaboration tools (whether on the Company network or one operated by others). 


WORKING ACROSS BORDERS - INTERNATIONAL TRADE & ANTIBOYCOTT 
REQUIREMENTS 


Exports 


Because Red Hat is a U.S. company, its products, services, source code, technical data, and 
technology are subject to both U.S. and local export laws and regulations, regardless of your 
work assignment or location. Export laws and regulations affect many Company 
transactions, including intra-Company transactions; technology transfers; transactions with 
other parties, including clients and suppliers; and use of business partners or others to 
complete a delivery or provide a service. 


Before Company products, services or technology can be exported, re-exported, or 
delivered anywhere, the Company must validate that it has the authorization to export 
under U.S. export regulations and any applicable non-U.S. laws and regulations. For help, 
contact the Export Compliance Team at exportcompliance@redhat.com. 


Defense Articles and Services 


If the Company's business with government agencies or contractors involves the provision 
(including brokering) of products, technical data, or services relating to military applications 
or defense articles, additional Company policies and government regulations may apply to 
your activities. U.S. Government authorization is required prior to any transfer or disclosure 
of U.S. defense articles or services outside the U.S. or to non-U.S. persons. Other countries 
apply similar restrictions on transfers and disclosures of their defense articles and services. 
If you have any questions about what you can or cannot do, consult the Legal Department. 
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Imports 


The Company must also comply with all import laws, regulations, and requirements when 
engaging in international trade. In addition to the cross-border movement of physical items, 
import implications may result from other activities, such as: 


e Client activity requiring cross-border delivery; 


e Calculation of product intra-Company prices for sales to a Company location in 
another country; 


e Determination of product country of origin; and 


e Maintenance of accurate data and records for product inventory, sales, and 
distribution. 


Antiboycott Requirements 


Red Hat and those acting on its behalf are prohibited from complying with or supporting a 
foreign country's boycott of a country that is friendly to the United States. Red Hat is 
required to report promptly to the U.S. Government any request to support a boycott or to 
furnish information regarding a boycott. 


WORKING WITH ORGANIZATIONS OUTSIDE THE COMPANY 


Whether you are selling, buying, or representing the Company in any other capacity, you 
must be ethical and lawful in your business dealings. Your actions can directly affect the 
Company's competitiveness, reputation, and compliance with applicable laws. 


The Company regularly works with other organizations - subcontractors, suppliers, 
consultants, agents, business partners, and competitors - and frequently has multiple 
relationships with these companies. You must understand these relationships and act in 
accordance with our guidelines. 


Working with other parties can present risks - the Company can be held liable for the 
misconduct of others, such as agents, consultants, or business partners. For example, if we 
know or have reason to believe a partner will offer or accept a bribe or kickback, the 
Company may be held accountable, even if the Company does not authorize or condone it. 
We require other parties with whom we interact to comply with many Company guidelines 
and meet our high standards of integrity in their work for us. If you are aware of or suspect 
another party is acting unethically or illegally, immediately report your concern to the Legal 
Department. 
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Dealing with Competitors 


Competition laws, also known as monopoly, antitrust, fair trade, or cartel laws, are intended 
to prevent interference with the functioning of a competitive market system and exist in 
almost all countries where we do business. Prohibited conduct may include: colluding with 
others to fix prices or divide territories, illegally monopolizing an industry, or unlawfully 
abusing a dominant position. 


Contacts with competitors require extra care. For example, exchanging competitive 
information with employees of a competitor can be a crime in certain circumstances. 


Avoid discussion of or collaboration on proprietary or confidential information, including 
pricing policies, contract terms, costs, inventories, marketing and product plans, market 
surveys and studies, production plans and capabilities, and allocating customers or 
territories. Such discussions may be illegal. If a competitor raises a prohibited subject, stop 
the conversation immediately and inform the competitor that you will not discuss these 
matters. If the competitor continues to discuss the prohibited subject, leave the meeting. 
Immediately report such incidents to the Legal Department. Collaborating with competitors 
creates risk. It is your responsibility to understand the rules that apply to such activities and 
to avoid prohibited subjects. Obtain prior approval of your manager and seek advice from 
the Legal Department before collaborating with competitors, including competing business 
partners. 


The Company and its competitors may attend conferences or trade association meetings 
where subjects of general interest are discussed without violating the law. Other acceptable 
contacts include sales to and purchases from other companies in our industry and approved 
participation in joint bids. You may also participate in Open Source communities and 
standards development organizations with competitors, provided proper care is taken with 
Company confidential information. 


Working with Government Entities and Other GOEs 


The Company engages with government-owned or -controlled entities (which we will refer 
to as GOEs) in many ways - for example, as customers, suppliers, consultants, or business 
partners. GOEs include both government entities and state-owned enterprises. Dealing 
with GOEs, their representatives, and government officials or their family members raises 
unique business and compliance issues, and you must follow the Company's established 
processes and controls to address them. 


Before you engage in any business activity, including marketing or sales activities, it is your 
responsibility to determine if the party you are dealing with is a GOE or a government 
official (or a family member of one). 
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GOEs include government entities and state-owned enterprises. “Government entities” 
include government agencies, departments, branches, instrumentalities, and public 
enterprises, whether regional, national or local, as well as: 


e Government-owned or -controlled schools, hospitals, utilities, and other 
organizations that provide public services; 


e Public international organizations, such as the United Nations or World Health 
Organization; and 


e Entities that procure under public procurement laws and regulations. 


“State-owned enterprises" can be any other type of entity - even those that are privately 
held or publicly traded - if they are owned, controlled, organized, or sponsored by a GOE or 
a government official. A government official is an officer or employee of a GOE as well as 
any private individuals or entities acting in an official capacity on behalf of one. 


If you are uncertain, don’t guess; ask the Legal Department for help. 


PROTECTING AGAINST CORRUPTION, ESPECIALLY WHEN WORKING 
WITH GOES 


The Company prohibits bribery and kickbacks of any kind. Never offer or give anyone, or 
accept from anyone, anything of value that is, or could be viewed as, a bribe, kickback, or 
other improper benefit. Also, never improperly attempt to influence that person's or entity's 
relationship with the Company, whether to obtain or retain business, or receive some other 
benefit. You may not make such payments or offer such benefits through others, such as 
agents, contractors, consultants, business partners, trade associations, or suppliers. 


Likewise, we expect everyone we interact with - including suppliers, business partners, 
resellers, agents, contractors, and consultants - not to accept or offer bribes or kickbacks. 
Anti-corruption laws around the world make bribery a crime. Some laws, like the U.S. 
Foreign Corrupt Practices Act and Brazil's Clean Company Act, focus on bribery of 
government officials. Other laws, like the UK Bribery Act, prohibit bribery of employees of 
commercial entities as well. 


When working with business partners, suppliers or others, watch for warning signs of 
corruption and bribery, such as: 


e Discrepancies in records or unexplained payments; 
e Deep discounts, high margin, or abnormally high prices; 
e Lack of skills or resources to do the job; 


e Parties with no legitimate purpose in the deal; 
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e Extravagant expenses; 
e Suspicious personal relationships or business arrangements. 


Remember, you can violate anti-bribery laws by offering or providing anything of value to 
obtain or retain business or secure some other improper benefit. “Anything of value” means 
just that: anything, including money, meals, gifts, entertainment, transportation, travel, 
accommodations, event entrance fees, charitable contributions, and even employment or 
internships (paid or unpaid). 


Giving and Receiving Business Amenities and Gifts 


In our day-to-day business activities, we may offer and receive customary business 
amenities or gifts (like meals, transportation, lodging, entertainment, event entrance fees, 
referral fees and, in limited circumstances, gifts) to promote Company products and 
services, build goodwill, and strengthen working relationships. You must follow Company 
processes and obtain any required pre-approvals before giving or receiving business 
amenities or gifts. Review and follow Red Hat's Policy on Business Entertainment and 
Amenities for additional guidance. 


Giving. Get your manager's approval before giving business amenities or gifts to others. 
Consult Red Hat's Policy on Business Entertainment and Amenities and obtain any required 
approvals from the Legal Department before giving business amenities or gifts to 
government officials, employees of government entities, GOEs or, in some countries, 
employees of commercial entities. Red Hat employees may not give an external party any 
cash, gift cards, gift certificates, or any other cash equivalents other than an award 
(generally a gift card) that is offered as part of an event or as a prize with the Legal 
Department approval. 


Many jurisdictions restrict giving business amenities or gifts, directly or through others, to a 
government official or an employee or representative of a government entity, state-owned 
entity or, in some cases, commercial party. Make sure you understand the anti-bribery laws, 
ethics rules, and gift and other laws that apply where you work before offering anything of 
value to anyone. If you have any questions, don’t guess. Ask your manager or the Legal 
Department - they can help. 


Employment and Internships. Never promise or provide employment or internships for 
the purpose of obtaining a business advantage or other preferential treatment for the 
Company. Hiring must be done in accordance with applicable Company policies and 
processes. 


Charitable Contributions. Follow the section on charitable contributions included in the 
Company's Policy on Business Entertainment and Amenities before giving a charitable 
contribution, grant, or donation on behalf of the Company. This includes sponsoring events 
hosted by non-profits, purchasing tables at events, and making other contributions of any 
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kind. Never make, or ask someone else to make on the Company's behalf, a charitable 
contribution to obtain a business advantage or preferential treatment for the Company. 


Receiving. Neither you nor any member of your family may, directly or through others, 
solicit or accept from anyone money or any other business amenity, other than items of 
nominal value in the circumstances and, for business entertainment where both you and the 
provider are present, reasonably modest amenities permitted by Red Hat's Policy on 
Business Entertainment and Amenities. In no case may you solicit or accept a business 
amenity or gift of any value where doing so could influence or reasonably give the 
appearance of influencing the Company's business decisions. If you or your family members 
receive any such business amenity (including money), even if unsolicited, notify your 
manager and take appropriate measures, which may include returning or disposing of what 
you received. Red Hat employees may not receive from an external party any cash, gift 
cards, gift certificates, or any other cash equivalents other than a gift card of nominal value. 
A gift will be considered of “nominal value” if it is $100 USD or less, provided that, in the 
case of gift cards, the value must be $20 USD or less. If you are uncertain whether a gift or 
other business amenity may be accepted, please contact the Legal Department. 


It is not unusual for software and hardware companies in the Company's industry to offer 
free software and/or hardware to employees for testing purposes. If you are offered such 
equipment, you may accept it on behalf of the Company provided the equipment is 
necessary to your performance of your job or an open source project in which you 
participate and you notify the Legal Department of the hardware or software contributed. 
All such donated hardware and software shall be the property of the Company. 


Avoiding Money Laundering and Funding Terrorist Activities 


We must comply with applicable laws prohibiting money laundering and terrorism financing. 
The Company has implemented policies and processes to help prevent and detect 
inappropriate or suspicious activities. Employees who are responsible for making or 
receiving payments on behalf of the Company must guard against the use of our funds, 
products, and services for purposes of money laundering, terrorism financing, or other 
criminal activity. Report any suspicious transactions or payments, or raise questions to your 
manager or the Legal Department (see “Reporting and Compliance Procedures” below). 


Be alert for suspicious transactions, such as: 
e Payments made in currencies other than the currency specified in the contract; 
e Over-payments and requests for refunds; and 


e Unusual fund transfers to or from parties or countries not involved in the deal. 


Red Hat Confidential Page 13 Updated February 2, 2022 


Selling in the Public Sector 


Public sector procurement laws are designed to ensure that products and services sold to, 
or for the benefit of, a government entity or other GOE are procured at fair and reasonable 
prices. The regulations and procedures around public sector procurement are complex and 
vary widely. It is your responsibility to identify and comply with applicable regulations and 
procedures. 


Sole Source. Comply with all laws and Company policies concerning sole source 
procurements and contact the Legal Department with any questions. 


Access to Information. Do not, directly or indirectly, obtain oral or written information 
(including advance copies of solicitation or tender documents and government planning 
and budgetary documents) that has not been made available to the general public or to all 
bidders, or that is subject to restrictions regarding its use. Do not seek or obtain 
non-publicly available information regarding competitors’ bids or the decision-making 
process of the GOE. It is your responsibility to make sure you have only appropriate 
information. If you are uncertain about any information, consult with the Legal Department. 


Pre-Bid Activities. Be careful when communicating with government agencies on 
procurement matters - contact the agency only through the person(s) designated by the 
government for a solicitation. Do not prepare a solicitation document on behalf of a public 
sector customer, even at the customer's request; submit any anonymous documents, such 
as white papers, to a public sector customer; or encourage a public sector customer to sign 
an agreement before an award is made to the Company. Doing so may prevent us from 
subsequently bidding. 


Hiring and Business Opportunities. Do not discuss business or employment 
opportunities that could personally benefit any public sector employees involved in 
procurement planning or decisions (or their family members) before or during the course of 
a bid. Ethical and legal restrictions may apply - before and after the Company wins the bid 
and on an ongoing basis during and after government employment. 


Pay-to-Play. Some jurisdictions have “pay-to-play” laws that impact public sector 
contractors, like the Company. If you are in a senior position within the Company or if you 
have responsibility for negotiating or overseeing government contracts, you and your family 
members may be restricted from giving personal political donations in some jurisdictions. 
Understand and comply with all restrictions that apply to you and contact the Legal 
Department with any questions. 


Fulfilling Contract Requirements. Do not ship, provide, or invoice products and services 
to a GOE until the Company receives a valid order (e.g., purchase order) containing terms 
and conditions acceptable to the Company. A limited exception to this rule may be 
approved by the Legal, Accounting, and Services Departments pursuant to Red Hat's 
established processes. 
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Using Agents And Consultants; Teaming With Competitors. Approval of the Legal 
Department is required before using any agents or consultants for Red Hat (which does not 
include partners reselling Red Hat offerings) on public sector procurement deals. Teaming 
with competitors on public sector deals (e.g., bidding as a consortium with a competitor) 
presents several risks — consult with the Legal Department. 


Contingent Fees. A contingent fee is a fee paid by one party to another party for securing 
business for the first party. Some jurisdictions prohibit paying or receiving contingent fees 
for sales to a GOE. Get approval from the Legal and Accounting Departments before 
agreeing to contingent fees or other incentives. 


If you have any questions, need help or are aware of or suspect any violation of these public 
sector guidelines or of a public sector procurement law, consult the Legal Department. 


Other Interactions with Government Personnel or Candidates for Public Office 


Lobbying. You must obtain prior written approval from Red Hat Legal Department's 
Government Affairs and Global Public Policy team to engage in such contacts (which may 
include lobbying) or to authorize anyone else - like a consultant, agent, trade association, or 
business partner - to engage in such contacts on the Company's behalf either directly or 
through a third party. Any contact with government personnel to influence any legislation, 
regulation, policy, or government action is strictly reviewed by the Legal Department's 
Government Affairs and Global Public Policy team and may be considered lobbying, 
including possible responses to government requests for comments on any public policy 
matter. Under some laws, lobbying even includes normal marketing, procurement, and sales 
activities directed to government customers. You are responsible for knowing and 
complying with all relevant lobbying and associated gift laws and reporting requirements. 


Use of Company Property - Government Officials and Candidates for Public 
Office. Company resources, including but not limited to Red Hat email addresses, 
telephones, messaging systems, premises, or Brand assets, may not be used to engage in 
electioneering, for endorsement of or campaigning on behalf of candidates for public 
office, ballot initiatives, or efforts to influence government action on legislation, regulation, 
or any policy without prior approval of Red Hat’s General Counsel or Vice President of 
Government Affairs and Global Public Policy. You must obtain approval from the Legal 
Department's Government Affairs and Global Public Policy team before inviting current or 
former public officials and candidates for public office to a Company office or 
Company-sponsored event. 


If permitted by applicable law and with prior approval of the Legal Department, the 
Company may reimburse the actual and reasonable travel expenses incurred by a public 
official in connection with an approved Company speaking engagement, but the Company 
generally does not pay honoraria. 
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Hiring Current and Former Government Employees. Current and former government 
employees may need government clearance before discussing employment with the 
Company. Requirements differ by jurisdiction - check with the People Team. 


REPORTING AND COMPLIANCE PROCEDURES 


Every employee has the responsibility to ask questions, to seek guidance, to report 
suspected violations, and to express concerns regarding compliance with this Code. If you 
know or believe that any other employee or representative of the Company has engaged or 
is engaging in Company-related conduct that violates applicable law or this Code, you 
should report such information to your manager (if you feel comfortable doing so) or to the 
Legal Department. You may report such conduct openly or anonymously without fear of 
retaliation, as further described below. 


The Company will not discipline, discriminate against, or retaliate against any employee for 
reporting such conduct in good faith, whether or not such information is ultimately proven 
to be correct, or for cooperating in any investigation or inquiry regarding such conduct. Any 
manager who receives a report of a violation of this Code must immediately inform the 
Legal Department. If you believe you have been retaliated against for such a report, please 
share your concern with the Legal Department. 


You may notify the Legal Department and report violations of this Code on a confidential or 
anonymous basis, except where anonymous reporting is prohibited by law, by calling Red 
Hat's Compliance and Ethics Hotline at 800-224-9902 or 678-999-4553. Your message 
will be directed to the Legal Department. While we prefer that you identify yourself when 
reporting violations so we may follow up with you as necessary for additional information, 
you may leave messages anonymously. You may also contact the Legal Department by 
email at |egal@redhat.com or by mail at the following address: Red Hat, Inc.; Attn: Red Hat 
Legal Department; 100 East Davie Street; Raleigh, NC 27601. 


If you have a similar concern involving conduct by an IBM representative outside of Red Hat, 
or otherwise wish to contact Red Hat's parent company, IBM, you may do so by sending an 


email to confidentiallyspeaking@us.ibm.com. 


When the Company's customer is in the public sector, the Company is that customer's 
“contractor.” U.S. law provides for certain rights, remedies, and protections for contractor 
employees who, in connection with U.S. government contracts or funds, report internally or 
to certain government officials or entities information the employee reasonably believes is 
evidence of gross mismanagement or waste, abuse of authority, violation of law, or a 
substantial and specific danger to public health and safety. 


In the United States, trade secrets are protected under both federal and state law. It will not 
be a violation of the Code, and you will not be held liable under any U.S. federal or state 
trade secret law, if you disclose a trade secret in confidence to the government or an 
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attorney solely for the purpose of reporting or investigating a suspected violation of law, or 
if you disclose a trade secret under seal in a complaint or other filing or in response to a 
court order in a lawsuit or other proceeding. 


If the Red Hat Legal Department receives information regarding an alleged violation of this 
Code or of law, it shall, as appropriate, initiate an inquiry or investigation and take any 
appropriate responsive action. Employees shall cooperate fully with any such inquiry or 
investigation - for example, promptly, completely, and truthfully comply with all Company 
requests; participate in meetings and interviews in a timely manner when requested; and 
provide, keep, and make available for inspection all relevant information relating to Red 
Hat's business (from any device or location, electronic or otherwise, within their possession 
or control) as directed or determined by the Company. Failure to cooperate with any such 
inquiry or investigation may result in disciplinary action, up to and including termination of 
employment by Red Hat. 


Failure to comply with the standards outlined in this Code, as determined by the Company 
in its discretion, will result in disciplinary action including, but not limited to, reprimands, 
warnings, probation or suspension without pay, demotions, reductions in salary, termination, 
and restitution. Certain violations of this Code may require the Company to refer the matter 
to the appropriate governmental or regulating authorities for investigation or prosecution. 


Moreover, any manager who directs or approves of any conduct in violation of this Code, or 
who has knowledge of such conduct and does not immediately report it, also will be subject 
to disciplinary action, up to and including termination of employment by Red Hat. All such 
disciplinary actions are to be taken in accordance with the laws pertaining to the place of 
employment of the subject party, including laws governing due process and employment, 
and such other agreements of employment as may exist between the Company and the 
subject employee. 


DISSEMINATION AND AMENDMENT 


This Code shall be distributed annually to each employee of the Company, and all 
employees shall certify that they have received, read, and understood the Code and have 
complied with its terms. 


The Company reserves the right to amend, alter, or terminate this Code at any time for any 
reason. The most current version of this Code can be found in the Legal Policies and 
Guidelines section of the Company's intranet. 


This document is not an employment contract between the Company and any of its 


employees or officers and does not alter any existing employment contract, if any, or, where 
no such employment contracts exists, the Company's at-will employment policy. 
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CERTIFICATION 


; do hereby certify that: 


(Print Name Above) 


1. Ihave received and carefully read Red Hat's current Code of Business Conduct and 
Ethics. 


2. |understand the Code of Business Conduct and Ethics. 


3. Iwill comply with the terms of the Code of Business Conduct and Ethics. 


(Date) (Signature) 


Each employee is required to return this certification to the company within 14 days of request. 
Failure to do so may result in disciplinary action up to and including termination. 


Red Hat Confidential Page 18 Updated February 2, 2022 


